US 9,792,447 B2 · Method and apparatus for differently encrypting different flows

Abstract

For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel encryption method for encrypting the data messages sent by the GVMs. The method initially receives a data message to send for a GVM executing on the host. The method then determines whether it should encrypt the data message based on a set of one or more encryption rules. When the process determines that it should encrypt the received data message, it encrypts the data message and forwards the encrypted data message to its destination; otherwise, the method just forwards the received data message unencrypted to its destination. In some embodiments, the host encrypts differently the data messages for different GVMs that execute on the host. When two different GVMs are part of two different logical overlay networks that are implemented on common network fabric, the method in some embodiments encrypts the data messages exchanged between the GVMs of one logical network differently than the data messages exchanged between the GVMs of another logical network. In some embodiments, the method can also encrypt different types of data messages from the same GVM differently. Also, in some embodiments, the method can dynamically enforce encryption rules in response to dynamically detected events, such as malware infections.

Claims21

Dependent claims

For a computer that executes a virtual machine (VM), an encryption method comprising:

detecting starts of different data message flows from the VM;
identifying, at an introspection agent on the VM, attribute values of the detected data message flows;
based on detecting a start of a first data message flow, analyzing a set of encryption policies based on the identified attribute values of the first data message flow to generate a first encryption rule for the first data message flow that identifies a first encryption key, and providing the first encryption rule to an encryptor that receives data messages intercepted along an egress datapath that the VM's data messages employ to exit the computer, in order (i) to encrypt, using the first encryption key, messages in the first data message flow that the VM sends unencrypted and (ii) to return the encrypted messages to the egress datapath for transmission out of the computer;
and
based on detecting a start of a second data message flow, analyzing a set of encryption policies based on the identified attribute values of the second data message flow to generate a second encryption rule for the second data message flow that identifies a second encryption key, and providing the second encryption rule to the encryptor that receives data messages intercepted along the VM's egress datapath in order (i) to encrypt, using the second encryption key, messages in the second data message flow that the VM sends unencrypted and (ii) to return the encrypted messages to the egress datapath for transmission out of the computer.

2 more elements

A non-transitory machine readable medium storing a program for encrypting messages from a virtual machine (VM) that executes on a computer, the program comprising sets of instructions for:

detecting starts of different data message flows from the VM;
receiving from an introspection agent on the VM, identification of attribute values of the detected data message flows;
based on detecting a start of a first data message flow, analyzing a set of encryption policies based on the identified attribute values of the first data message flow to generate a first encryption rule for the first data message flow that identifies a first encryption key, and providing the first encryption rule to an encryptor that receives data messages intercepted along an egress datapath that the VM's data messages employ to exit the computer, in order (i) to encrypt, using the first encryption key, messages in the first data message flow that the VM sends unencrypted and (ii) to return the encrypted messages to the egress datapath for transmission out of the computer;
and
based on detecting a start of a second data message flow, analyzing a set of encryption policies based on the identified attribute values of the second data message flow to generate a second encryption rule for the second data message flow that identifies a second encryption key, and providing the second encryption rule to the encryptor that receives data messages intercepted along the VM's egress datapath in order (i) to encrypt, using the second encryption key, messages in the second data message flow that the VM sends unencrypted and (ii) to return the encrypted messages to the egress datapath for transmission out of the computer.

2 more elements

Dependencies are inferred from the claim text.

Method and apparatus for differently encrypting different flows

Life of this patent

Method and apparatus for differently encrypting different flows

Life of this patent

Abstract

Claims21